Posted
by
Soulskill
on Saturday July 05, 2008 @03:59AM
from the heal-thyself dept.

NotNormallyNormal writes "CBC picked up an AP story about ICANN recently losing control over two of their domain names on Thursday, June 26. A domain registrar run by the group transferred the domains to someone else. ICANN's press release had this to say: 'As has been widely reported, a number of domain names, including icann.com and iana.com were recently redirected to different DNS servers, allowing a group to provide visitors to those domains with their own website. It would appear the attack was sophisticated, combining both social and technological techniques, but was also limited and focused.' Comcast has had similar troubles lately as well."

I hear a group of rogue trolls tricked ICANN into making Slashdot.org resolve to goatse.cx. You must've come back at the right time (or wrong time, depending on whether you're into the kind of stuff;))

The Internet Corporation for Assigned Names and Numbers (ICANN) is a technical coordination body for the Internet. Created in October 1998 by a broad coalition of the Internet's business, technical, academic, and user communities, ICANN is assuming responsibility for a set of technical functions previously performed under U.S. government contract by IANA and other groups.

In a perfect world, this would serve as a wake-up call to ICANN that the current domain name policies are hideously flawed.

Of course, their heads are so far up their collective asses, though, that they'll just say it was an awesome example of domain tasting by a third party, and all part of the glorious monstrosity they have birthed.

ICANN, as far as I can tell, does not follow rules. Their one and only purposes seems to be to enrich the members of its board. As a result, we have a stagnant generic TLD system with new proposals, etc being designed to extract cash for them rather than benefit the world. I have no problem with them getting hacked -- throws a spotlight on their arrogance and corruption.

ICANN'T do anything to help the world because I am too busy getting paid.

Kimba, Thanks for the backup, but this isn't what I was talking about. I wish I had taken a screenshot of it. When I did that same exact whois search, the information was completely different. It returned correctly, but it contained the organization's name and nothing else.

I would consider this whois info you just posted valid information (as far as I'm aware). I don't think an organization should be faulted for having multiple addresses -- many organizations do have multiple addresses. Also, according to

When I first read this news several days ago, I thought it was referring to the root servers...

What most don't know is that the TLDs (ie. com,.net, etc) themselves are registered in much the same manner as 2nd level domains are... see the TLD Whois: http://whois.iana.org/ [iana.org]

The major TLDs (.com,.net, etc) are relatively safe, since any changes would likely be difficult to get through - with any changes quickly noticed... as in within minutes, or even seconds; likely wouldn't even be that effective, since the most popular TLDs zone dns entries are heavily cached.

However, ccTLDs are a different story completely, since ccTLD zone name server changes are more common and thus such change requests would be far less scrutinized.

I've never heard of any TLD being hijacked, but could likely be easily done, since the social engineering involved would be very similar. A frightening prospect.

The major TLDs (.com,.net, etc) are relatively safe, since any changes would likely be difficult to get through - with any changes quickly noticed... as in within minutes, or even seconds; likely wouldn't even be that effective, since the most popular TLDs zone dns entries are heavily cached.

However, ccTLDs are a different story completely, since ccTLD zone name server changes are more common and thus such change requests would be far less scrutinized.

I've never heard of any TLD being hijacked, but could likely be easily done, since the social engineering involved would be very similar.

Changes to TLD nameservers need to pass human inspection at the IANA, human inspection at the US Department of Commerce, and human inspection at Verisign (who provide maintenance for the root zone). This is in stark contrast to the largely mechanical process by which domains in gTLD and ccTLD registries are modified.

Requests to change entire NS sets (as opposed to simply dropping a couple and adding a couple of other nameservers) are typically stalled early in the process while the IANA requests justificati

Why do registrars even have to exist? And why does ICANN need to pay other companies to run the actual DNS infrastructure? If ICANN ran.com,.org and.net itself, and there were no registrars/resellers, and every time someone paid for a domain all the money went straight to ICANN, surely ICANN would have enough money to run all the DNS infrastructure itself very well. Then we wouldn't have to deal with all the dodgy things that registries and registrars do, like Verisign's "Site Finder", and various slightly evil registrars stealing domains, and various registrars being incredibly insecure and transferring domains to hackers without proper authentication.

Why re-invent fire? If someone in the industry already knows how and provides the service for a fee you're willing to pay because it's much less than what it would cost you to learn, secure, and implement properly, then why do it again, pay more for it, and not sleep well at night? Let the other guy lose sleep.

After reading their news release, this goes from "whoo 31337 h4x0r5 shr R Sm4r7" to disgruntaled soon to be ex employee getting he and and all his friends 12 year domains for free for as long as the DNS record is changed. It was an inside job by someone who had access to the Registrar's internal network.

Whoever made the change knew the system and how ICANN and IANA work, and also knew that ICANN can not really say 'well if you got your domain durin

Hmm, in the CBC article is says "Visitors to those addresses are normally redirected automatically to the organization's main sites at ICANN.org and IANA.org, neither of which was affected by the attack."

What is to *re*direct here? DNS is there to translate domain names into IP addresses. It does not have any *re*direction mechanisms. Redirection is a feature of the HTTP protocol and would require to compromise the web-server (which they state has not happened.)

I wonder, Is this simply a typo or does the journalist/editor not understand what (s)he is writing about (and has no references to have this proof read)?

I'm rather vary, because I see such factual errors often in widely read media, written and edited by journalists. Sometimes I see even "experts" quoted with wrong statements. How does this reflect on news that I don't know so much about that I can spot the factual errors?

Well, I would like to hold professional journalists to higher standards.

While I agree that it is a subtle difference, it is a difference I expect a professional word smith (journalist) to pick up and to question its meaning. No degree in CS required, but a critical mind and some sense for the kind of spin that press releases contain.

And I expect for a reporter to report facts and question them and not "for a reporter to assume." If (s)he simply wants to reprint the press release that is fine with me, but te

Not to talk to myself, but I just also read the "press release" from ICANN. It says the same things "icann.com and iana.com were recently redirected to different DNS servers." How can that be?

The press release also talks about "The domains in question are used only as mirrors for ICANN and IANA's main websites." Well, as of today the domains and the www.... simply point to the same web IP address, which is presumably served by the same server. In my book this is hardly a mirror, which would imply it is some

You're being deliberately pedantic. I thought it was perfectly clear exactly what they meant:

Normally, A records for icann.com, www.icann.com, iana.com, www.iana.com and similar FQDNs point to IP addresses of web servers that are configured to send an HTTP redirect (via the Location header) that tells the browser to request e.g. http://www.icann.org/ [icann.org] if http://www.icann.com/ [icann.com] had been originally requested.

While more technically specific, this takes a lot more words to say than "Visitors to those addresses a

Well, may be we need to be that pedantic. My read on what ICANN's press release says is the exact opposite.

The press release says clearly that the http server was not compromised ("The organizations' actual websites at icann.org and iana.org were unaffected. "), but instead the DNS records at the root server were directed to a different DNS server ("The DNS redirect was a result of an attack on ICANN's registrar's systems.") who did reply with different IP addresses that did not belong to ICANN and served a

I'm confused as to what you're confused about. Somebody got icann.com and iana.com to point to different DNS servers which served A records pointing to third-party IP addresses, so that queries for http://www.icann.com/ [icann.com] and http://www.iana.com/ [iana.com] went to a third-party HTTP server which did not return a redirect to ICANN's official web sites (like ICANN's HTTP server would have), but instead returned something else.

I didn't bother to read the article (I'm not new here), but what about this is unclear to you?

Talk about a bunch of completely incapable morons... and we're depending on THEM to keep the Internet running?

Sheesh.. I hope it happens every damned day. In fact I hope someone brings the whole damned thing down. Maybe then the Powers That Be (whoever / whatever THAT is) will replace ICANN top to bottom, clean up the entire domain mess, and give us an honest system.

I noted a similar incident a long time ago, as I pointed out once in this message [ietf.org] which was nothing more than one organization filing for the domain name of another, (Sprint registering for the name "MCI.NET") but rather humorous in the result.